Details of VAR-202001-1478

ID

VAR-202001-1478

CVE

CVE-2019-10583

TITLE

plural Snapdragon Products use free memory vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-014205

DESCRIPTION

Use after free issue occurs when camera access sensors data through direct report mode in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8096AU, MDM9607, MSM8909W, Nicobar, QCS605, SA6155P, SDA845, SDM429W, SDM670, SDM710, SDM845, SM6150, SM8150, SM8250, SXR1130, SXR2130. plural Snapdragon The product contains a vulnerability related to the use of freed memory.Information is acquired, information is falsified, and denial of service (DoS) May be in a state

Trust: 1.62

sources: NVD: CVE-2019-10583 // JVNDB: JVNDB-2019-014205

IOT TAXONOMY

category:	['other device', 'embedded device']	sub_category:	SoC	Trust: 0.1
category:	['other device', 'embedded device']	sub_category:	general	Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:	qualcomm	model:	sm8150	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sda845	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sa6155p	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8096au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	nicobar	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8909w	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcs605	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm845	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sm6150	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sxr1130	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sxr2130	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sm8250	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm429w	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9607	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm670	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm710	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8096au	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	mdm9607	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	msm8909w	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	nicobar	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	qcs605	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sa6155p	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sda845	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sdm 429w	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sdm 670	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sdm710	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2019-014205 // NVD: CVE-2019-10583

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-10583
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-10583
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202001-191
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2019-10583
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

nvd@nist.gov:	CVE-2019-10583
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-10583
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2019-014205 // CNNVD: CNNVD-202001-191 // NVD: CVE-2019-10583

PROBLEMTYPE DATA

problemtype:

CWE-416

Trust: 1.8

sources: JVNDB: JVNDB-2019-014205 // NVD: CVE-2019-10583

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202001-191

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202001-191

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-014205

PATCH

title:	January 2020 Security Bulletin	url:	https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin	Trust: 0.8
title:	Multiple Qualcomm Product resource management error vulnerability fixes	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=108324	Trust: 0.6

sources: JVNDB: JVNDB-2019-014205 // CNNVD: CNNVD-202001-191

EXTERNAL IDS

db:	NVD	id:	CVE-2019-10583	Trust: 2.5
db:	JVNDB	id:	JVNDB-2019-014205	Trust: 0.8
db:	CNNVD	id:	CNNVD-202001-191	Trust: 0.6
db:	OTHER	id:	NONE	Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2019-014205 // CNNVD: CNNVD-202001-191 // NVD: CVE-2019-10583

REFERENCES

url:	https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2019-10583	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-10583	Trust: 0.8
url:	https://vigilance.fr/vulnerability/google-android-pixel-multiple-vulnerabilities-of-january-2020-31267	Trust: 0.6
url:	https://ieeexplore.ieee.org/abstract/document/10769424	Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2019-014205 // CNNVD: CNNVD-202001-191 // NVD: CVE-2019-10583

SOURCES

db:	OTHER	id:	-
db:	JVNDB	id:	JVNDB-2019-014205
db:	CNNVD	id:	CNNVD-202001-191
db:	NVD	id:	CVE-2019-10583

LAST UPDATE DATE

2025-01-30T21:05:35.007000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2019-014205	date:	2020-02-06T00:00:00
db:	CNNVD	id:	CNNVD-202001-191	date:	2020-05-15T00:00:00
db:	NVD	id:	CVE-2019-10583	date:	2024-11-21T04:19:30.297

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2019-014205	date:	2020-02-06T00:00:00
db:	CNNVD	id:	CNNVD-202001-191	date:	2020-01-07T00:00:00
db:	NVD	id:	CVE-2019-10583	date:	2020-01-21T07:15:11.837